Malicious software family classification method based on static multi-feature optimization and fusion

Abstract

The invention discloses a malicious software family classification method based on static multi-feature optimization and fusion. The method comprises the steps that malicious software image features are extracted based on OfficientNet-B3; performing static API sequence extraction by adopting IDA Pro and Radare2 respectively, and fusing extraction results of the IDA Pro and the Radare2 to obtain a fused static API sequence; extracting static statistical characteristics of malicious software; carrying out feature optimization on the fused static API sequence on the basis of a BERT-Tiny embedding mechanism; on the basis of the extracted and optimized features, calculating mutual information values of the features by adopting a discrete target variable mutual information algorithm, and screening out an optimal fusion feature sequence combination on the basis of the mutual information values of the features; and inputting the optimal fusion feature sequence combination into a classification model to complete malicious software family classification. The method solves the problems of single feature type, much redundant information, low classification efficiency and the like.

Description

Technical Field

[0001] The present invention relates to the field of malware defense technology, and in particular to a malware family classification method based on static multi-feature optimization and fusion. Background Art

[0002] The first phase of malware defense inspections involves preliminary screening of massive samples from real networks. Suspicious samples require further analysis, which is the second phase of malware defense. The amount of data at this stage is considerable, and efficient methods are still needed for further processing. At this stage, malware family classification is the mainstream research direction.

[0003] Research on malware family classification has important theoretical value and practical significance in the field of malware defense. For malware detection, research on family classification helps to reveal family characteristics, making it possible to identify unknown family variants; on the other hand, simple detection and prevention are always passive. In order to better curb the development of malware from the root, research institutions and security companies have carried out analysis and research on malware tracing, and malware family classification is an important technical support for family tracing.

[0004] After the first phase of testing, the suspicious samples identified usually include the following three categories:

[0005] The first category is sample software that can directly implement static reverse analysis. This is the most ideal situation. This type of malware samples are usually ordinary viruses, Trojans, worms, etc. They may be samples that have not been obfuscated, encrypted, or packed, or they may be protected using common packing, encryption, and other technologies. However, tools can be used to implement operations such as unpacking and decryption, and their complete assembly code and functions can be obtained through static reverse analysis. For this type of sample, static analysis can obtain various types of features such as the structure, semantics, and statistics of the program, which has always been one of the most popular and effective analysis methods in malware analysis. Therefore, for this type of file, studying the intelligent family classification method of malware based on static analysis features has important theoretical value and practical significance. The research work of this invention is to carry out family classification of this type of sample, especially focusing on feature optimization and fusion screening in the family classification process.

[0006] Family variants are new malware generated after the known malware has evolved through functions or anti-detection technologies. Existing family tracing work for malware variants generally extracts its feature information or part of the original code, and analyzes their similarity with known family samples to achieve family tracing of suspicious samples. In recent years, the intelligent classification work achieved with the help of machine learning technology has increased in existing research. The feature extraction in these works can be divided into two categories. One is similar to traditional detection work, which requires the use of relevant prior knowledge of malware to extract features such as readable strings, file structures, and function call graphs through static or dynamic analysis. Reference [Kinable, J., & Kostakis, O. (2011). Malware classification based on call graph clustering [J]. Journal in Computer Virology, 7, 233-245.] extracts the system call graph of malware samples and applies the graph matching method to analyze the similarity of malware, thereby achieving the purpose of identifying its family homology. Another type of research work does not rely on prior knowledge of malware, but directly uses machine learning methods to achieve family classification. The method of converting malware directly into grayscale images proposed in the literature [Nataraj, L., Karthikeyan, S., Jacob, G., & Manjunath, BS (2011). Malware images: visualization and automatic classification [C]. Visualization for Computer Security.] has opened up a new research direction in academia. Subsequent studies have continued the idea of ​​converting code into grayscale images and made various improvements on this basis. Some studies segment grayscale images and use gray level cooccurrence matrix features (Gray Level Cooccurrence Matrix, GLCM), and some research works introduce the concept of information entropy, propose the concept of entropy map, and classify malware by comparing the entropy values ​​of images.

[0007] These works have achieved certain results and contributed to the research of malware family classification, but there are still some problems that need to be improved: On the one hand, most of the existing works still use single features or single types of features, which means that these features can only cover part of the feature information of malware and cannot fully and comprehensively characterize the information carried by the original sample, that is, there is a certain amount of information loss, which affects the final classification results. On the other hand, some research works have begun to try to combine multiple features, but most of them are implemented in a simple splicing way without optimizing and selecting features, which can easily lead to too large feature dimensions, increase training time overhead, and too much feature redundancy will disperse the weight of the impact of effective features on the classification results, making it difficult to focus on the features that really work. Summary of the invention

[0008] In view of the above problems, the present invention proposes a malware family classification method based on static multi-feature optimization and fusion, focusing on feature extraction, feature optimization and feature fusion, and focusing on solving problems such as single feature type, much redundant information and low classification efficiency. It includes static multi-type feature extraction of malware, feature optimization based on deep learning model and feature fusion based on mutual information of discrete target variables.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] A malware family classification method based on static multi-feature optimization and fusion, including:

[0011] Step 1, extracting malware image features based on the deep neural network EfficientNet-B3; using disassemblers IDAPro and Radare2 to extract static API sequences respectively, and fusing the results of the two extractions to obtain a fused static API sequence; extracting malware static statistical features, the static statistical features including statistical features of assembler files, statistical features of binary byte files, and file byte sequence features;

[0012] Step 2: Optimize the features of the fused static API sequence based on the lightweight natural language processing model BERT-Tiny embedding mechanism;

[0013] Step 3: Based on the code image features extracted in step 1, the static statistical features of the malware, and the static API sequence features optimized in step 2, the mutual information value of the features is calculated using a discrete target variable mutual information algorithm, and the optimal fusion feature sequence combination is selected based on the mutual information value of the features;

[0014] Step 4: Input the optimal fusion feature sequence combination into the classification model to complete the malware family classification.

[0015] Furthermore, the extraction of code image features based on the deep neural network EfficientNet-B3 includes:

[0016] Every 8 bits of the malware binary file are combined into a vector, which is regarded as the grayscale value of a pixel in the grayscale image. A square code image with equal height and width is generated based on the image adaptation mechanism. Then, all the generated square images of different sizes are normalized to obtain grayscale images of the same size.

[0017] Taking the obtained grayscale image as input, the EfficientNet-B3 model is used to extract malware image features.

[0018] Furthermore, the fused static API sequence is obtained in the following manner:

[0019] IDAPro is used to recursively traverse and read the assembly file to obtain the static API sequence of the sample. Radare2 is used to extract the control flow information and then obtain the static API sequence of the sample. Two sets of static API sequences of the same file are obtained. The static API sequence extracted based on Radare2 and the static API sequence extracted based on IDAPro are fused in two ways to obtain the fused static API sequence.

[0020] Furthermore, statistical features of the assembler file are extracted in the following manner:

[0021] Construct a list of features to be matched, including registers, opcodes, keywords, and API call names;

[0022] Each feature in the feature list is counted in each program through string matching, and finally the feature vector is saved.

[0023] Furthermore, the statistical features of the binary byte file are extracted in the following manner:

[0024] For the binary byte file of the disassembled program, two features, file size and byte information entropy, are extracted as statistical features of the binary byte file. The total number of bytes contained in the statistical file is taken as the file size. The file byte information entropy is calculated as follows:

[0025]

[0026] where p k It is the ratio of bytes with value k to all bytes.

[0027] Furthermore, the file byte sequence features are extracted in the following manner:

[0028] For the assembly program file, the .asm file generated by IDAPro disassembly is selected, and the description of the key information of the program PE file and the description bytes of the program code segment initialization in the header part of the file are used as the file byte sequence feature vector;

[0029] For a binary byte file, take its first 1000 bytes as the file byte sequence feature vector.

[0030] Furthermore, the step 2 comprises:

[0031] First, the WordPiece algorithm is used to convert the static API sequence features into a vocabulary. Then, each static API sequence is represented as ([content vector, position vector], label) and input into the BERT-Tiny model for deep feature extraction. Finally, the output of the fully connected layer of the BERT-Tiny model is extracted and used as the optimized static API sequence feature vector.

[0032] Furthermore, the mutual information value of the feature calculated by using the discrete target variable mutual information algorithm includes:

[0033]

[0034] Where MI(X,Y) is the mutual information value of the discrete target variable between X and Y, X and Y are two discrete random variables, For X i and Y j The joint probability distribution of P(i) and P(j) are x i and Y j The marginal probability of is, N is the number of samples.

[0035] Furthermore, the method of selecting the optimal fusion feature sequence combination based on the mutual information value of the features includes:

[0036] The first n features with the highest mutual information values ​​are selected in turn and evaluated using K-fold cross validation of the machine learning model; the evaluation results are then recorded and the best feature combination is selected as the final selected fusion feature.

[0037] Furthermore, the classification model includes decision tree, logistic regression and random forest.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] (1) In terms of feature representation, the present invention selects three types of features, including statistical features based on static analysis, code image features, and static API sequence features. These three types of features contain multi-level and multi-type information at the instruction level, structure level, and behavior level. The feature combinations at different levels and types complement each other and more comprehensively characterize the program feature information of the original sample, which is more comprehensive than the single feature or single type feature representation commonly selected in existing work;

[0040] (2) In terms of feature extraction, the deep features extracted by the image feature extraction method based on EfficientNet-B3 proposed in the present invention are superior to the existing feature extraction methods based on traditional image texture features and other deep learning methods in terms of classification performance, both in visual analysis and quantitative analysis;

[0041] (3) In terms of classification efficiency, the fusion features obtained by the feature optimization and fusion method proposed in the present invention have a significantly reduced dimension, lower training overhead, and higher classification efficiency than the features obtained by directly splicing the extracted shallow features.

[0042] (4) In terms of classification effect, the fusion features extracted, optimized and integrated by the method proposed in the present invention have a classification accuracy rate at a relatively high level among existing related works on three different types of simple machine learning classification models. At the same time, compared with the existing mainstream features and the single optimized features proposed in the present invention, the fusion features have improved classification accuracy, precision, recall rate and F1-score. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flow chart of a malware family classification method based on static multi-feature optimization and fusion according to an embodiment of the present invention;

[0044] Figure 2 Comparison of the accuracy of EfficientNet provided by the embodiment of the present invention and other models;

[0045] Figure 3 Schematic diagram of scaling the EfficientNet model provided in an embodiment of the present invention;

[0046] Figure 4 Schematic diagram of the feature extraction model structure based on EfficientNet-B3 provided in an embodiment of the present invention;

[0047] Figure 5 An example of a static API sequence extracted and fused according to an embodiment of the present invention;

[0048] Figure 6 The .asm file format provided by the embodiment of the present invention;

[0049] Figure 7 A list of extracted register and operation code features provided by an embodiment of the present invention;

[0050] Figure 8 A list of keyword features provided for embodiments of the present invention (part);

[0051] Fig. 9 A list of API call features provided for embodiments of the present invention (partial);

[0052] Fig.10 .asm file statistical feature vector (part) provided by the embodiment of the present invention;

[0053] Fig.11 A byte file feature vector (part) provided by an embodiment of the present invention;

[0054] Fig.12 A byte sequence feature vector of an .asm file provided by an embodiment of the present invention;

[0055] Fig.13 A byte sequence feature vector of a .byte file provided in an embodiment of the present invention;

[0056] Fig.14 A flow chart of a fusion feature screening algorithm provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0058] like Figure 1 As shown in the figure, a malware family classification method based on static multi-feature optimization and fusion includes:

[0059] Phase I: Multi-type static feature extraction. It mainly includes the extraction of three types of features: the first type is code image feature extraction based on deep neural networks. Here we propose a code image deep feature extraction method based on EfficientNet-B3; the second type is the extraction of static API sequences. For each sample in the dataset, we use dual disassemblers to extract APIs separately and combine them to obtain a more complete static API call sequence; the third type is statistical feature extraction based on static analysis. We count basic program information including commonly used registers, opcodes, keywords, API calls, etc.

[0060] Phase 2: Feature optimization based on deep learning models. We propose static API sequence feature optimization based on the BERT-Tiny embedding mechanism, learn the implicit feature information of the API sequence, and perform dimensionality reduction.

[0061] The third stage: feature fusion based on the mutual information of discrete target variables. The features extracted and optimized above are integrated, and the feature scores are calculated using the discrete target variable mutual information algorithm to screen out the optimal feature sequence. The recursive algorithm is then used to screen and obtain more refined features to improve the efficiency and accuracy of classification.

[0062] Phase 4: Input the optimal fusion feature sequence combination into the classification model to complete the malware family classification.

[0063] 1. Malware multi-type static feature extraction

[0064] 1.1 Malware Image Feature Extraction Based on EfficientNet-B3

[0065] EfficientNet is a network series released by Google in 2019. EfficienNet is a series of models obtained by scaling the basic model. The basic model is an efficient network structure obtained by Neural Architecture Search (NAS) method. EfficienNet stands out for its fast and accurate features. For a comparison of EfficientNet with other models in terms of accuracy and number of model parameters, see Figure 2 , which has obvious advantages.

[0066] The basic model that EfficientNet searches for through NAS is EfficientNet-B0 in the figure above. On this basis, the three major features of the above-mentioned convolutional neural network accuracy improvement are comprehensively utilized to scale the model from three perspectives: network depth, width, and input image resolution to obtain higher accuracy. The resulting models are recorded as B1, B2, B3, ..., and the specific contents of the scaling are as follows: Figure 3 shown.

[0067] Malware has obvious texture features after being converted into grayscale images, and such features can be used to classify malware. To this end, this paper proposes a malware image feature extraction method based on EfficientNet-B3, which consists of two parts: malware visualization and malware grayscale image feature extraction.

[0068] During the malware visualization process, the specific operation is to first form a vector with every 8 bits of the malware binary file, whose value range is 0-255, and regard it as the grayscale value of a pixel in the grayscale image. Then, a square code image with equal height and width is generated, and then all the generated square images of different sizes are normalized to obtain a 512×512 grayscale image, which can better preserve the original texture characteristics of the image.

[0069] Convolutional neural networks have achieved good results in image recognition and other related applications, indicating that they can extract unique features of images through training and learning, and their performance improvement focuses on the three dimensions of network depth, network width, and resolution. Given that EfficientNet can uniformly scale these three dimensions through a set of fixed scaling factors, well balance depth, width, and resolution, give full play to their advantages, and has the characteristics of being fast and accurate, the present invention uses EfficientNet to automatically extract malware image features. The present invention uses the EfficientNet-B3 model to extract deep malware features. The overall structure of the feature extraction model is as follows: Figure 4 As shown in the figure, with a 512×512 grayscale image as input, EfficientNet-B3 adopts a scaling factor of (width, depth, res, dropout) = (1.2, 1.4, 300, 0.3), and obtains a 1536-dimensional feature vector after the average pooling layer. In order to reduce the amount of calculation for subsequent classification, the present invention adds Dense and Dense_1 layers after the pooling layer to reduce the extracted features from 1536 dimensions to 512 dimensions, so as to obtain more refined and accurate features and improve the efficiency of subsequent classification.

[0070] 1.2 API sequence feature extraction based on dual-path fusion

[0071] Existing research has proved through concept verification and quantitative analysis that different disassemblers will produce different results due to the use of different algorithms to identify the structure of binary files, and the use of a single disassembler will result in misjudgment (false positive and false negative), resulting in inaccurate information acquisition. Therefore, in the method of the present invention, two typical commonly used disassemblers IDA Pro and Radare2 with different working principles are selected, and the data set samples are reverse analyzed respectively, and the extraction results of the two are fused to obtain a more accurate API call sequence. Among them, IDA Pro is an industry-standard recursive disassembly tool, and Radare2 provides two disassembly modes, linear and recursive, and supports interactive and scripting. The two disassemblers complement each other in working principle.

[0072] IDA Pro is used to obtain the static API call sequence of the sample by recursively traversing and reading the assembly file. Radare2 is used to extract the control flow information and then obtain the static API call sequence of the sample, obtaining two sets of API call sequences for the same file. Due to the differences between the two disassembly tools, IDA Pro and Radare2, the disassembly results of the two tools are different for some malware. The API call sequence extracted based on Radare2 and the API call sequence extracted based on IDA Pro are dual-channel fused to form a more accurate static API call sequence feature set. Some of the obtained API call sequences are shown in the figure below. Figure 5 shown.

[0073] 1.3 Malware static statistical feature extraction

[0074] In this part, we mainly extract three types of features, including statistical features of assembly program files, statistical features of binary byte files and file byte sequences.

[0075] Statistical feature extraction of assembler files. By disassembling the .exe file, we can get the assembler file (.asm file) in the form of Figure 6 .

[0076] The assembly program file contains information such as registers, operation codes, keywords, APIs called by the program, etc. The present invention uses the method of traversing each line of matching strings to count the number of occurrences of these contents as statistical features. The specific steps are as follows:

[0077] (1) Construct a feature list that needs to be matched, which specifically includes registers, operation codes, keywords, and API call names. For registers, operation codes, and keywords, the present invention enumerates commonly used content as a feature list; for APIs, the present invention first counts the number of programs that exist for each API in the entire data set, and then takes the top 2,000 APIs with the largest number of programs and adds them to the constructed feature list. The purpose is to avoid the situation where some APIs are only used by a few programs, resulting in a large number of 0 values ​​in the feature vector, thereby affecting the classification effect. The constructed feature list is as follows:

[0078] Register features include 26 commonly used registers such as edx, esi, es, and fs. Operation code features include 93 commonly used operation codes such as add, al, bt, call, and cdq. The specific contents are as follows: Figure 7 shown.

[0079] Keyword features include 95 common keywords such as Virtual, Offset, loc, Import, etc. The specific content is as follows Figure 8 shown.

[0080] The API call features include GetProcAddress, GetModuleHandleA, GetLastError, LoadLibraryA, etc., a total of 2000 API calls. Some of the specific content is shown below. Fig. 9 shown.

[0081] (2) Through string matching, each feature in the feature list is counted in each program, and finally the feature vector is saved. The resulting csv file is as follows: Fig.10 shown.

[0082] Statistical feature extraction of binary byte files, for the binary byte files (.byte files) of the program obtained by disassembly. For .byte files, two features, file size and byte information entropy, are extracted as its statistical features. Among them, the file size statistics file contains the total number of bytes. Because the value range of bytes is 0-255, each value is a class, and the proportion of bytes with value k to all bytes is set to p k (k=1,2,3...,256), then the calculation method of file byte information entropy is shown in formula (1).

[0083]

[0084] The final feature vector is Fig.11 shown.

[0085] The present invention also extracts byte features for assembler files and binary byte files. Specifically, for assembler files, the .asm file generated by IDAPro decompilation is selected, wherein the header portion at the beginning of the file contains a description of the key information of the program PE file and a description of the initialization of the program code segment. This portion of bytes is used as a feature vector and saved to obtain a byte sequence feature vector of the .asm file, such as Fig.12 For binary byte files, the first 1000 bytes are directly taken as feature vectors. Since the malware is a PE file, the first 1000 bytes correspond to the PE header information of the malware, so this is directly extracted as a feature. The feature vector obtained is as follows: Fig.13 shown.

[0086] 2 Feature Optimization Based on BERT-Tiny Embedding Mechanism

[0087] When security personnel reverse analyze software, they will pay attention to the API call sequence in the code to understand the functions that the software wants to perform. Extracting static API call sequences is a simulation and restoration of this process. Therefore, static API call sequences have distinct word order and semantic logic, which is very suitable for feature optimization using natural language processing models.

[0088] In existing work, the use of API call sequence features usually involves selecting their statistical information as the vectorized processing and representation of the features. Such an operation directly loses the word order characteristics and cannot fully reflect the inherent implicit associations contained in it. Therefore, it is necessary to study more effective optimization methods that retain more original information.

[0089] Taking into account the operating efficiency and feature dimension, the present invention selects the lightweight BERT-Tiny (Bidirectional Encoder Representations from Transformers) embedding mechanism. BERT-Tiny is a lightweight natural language processing model, which is a subset of the BERT model developed by Google. Compared with the BERT model, the BERT-Tiny model has a smaller parameter amount and faster training and reasoning speed. The core of the BERT-Tiny model is the Transformer structure, which is stacked by multiple Encoders and Decoders. In BERT-Tiny, each Encoder and Decoder contains only 2 layers, and the dimension of the hidden state vector is small, only 128 dimensions. In addition, the BERT-Tiny model uses a simplified version of the Self-Attention mechanism, thereby reducing the amount of calculation and storage space. These characteristics are very consistent with the research requirements of high efficiency and low dimensionality of the feature optimization of the present invention, so it is more suitable for the feature optimization work of the present invention than BERT.

[0090] In terms of working principle, the BERT-Tiny model is similar to the BERT model. Both obtain vocabulary and model parameters by pre-training large-scale text corpora. In the pre-training stage, the model will learn the dependencies and contextual information between words through the Masked LanguageModel and Next Sentence Prediction tasks; in the fine-tuning stage, the BERT-Tiny model can also be used in various natural language processing tasks. It has strong transferability, that is, it uses the BERT-Tiny embedding mechanism to optimize features. When the requirements of subsequent classification tasks change, there is no need to redesign and adjust the optimization plan, but a simple fine-tuning can adapt to other types of subsequent natural language processing tasks. Therefore, it is very suitable for feature optimization work.

[0091] The feature optimization method based on the BERT-Tiny embedding mechanism proposed in the present invention selects the WordPiece algorithm to construct a vocabulary and uses it for fine-tuning learning of the BERT-Tiny model; at the same time, the method of the present invention combines the position vector to retain the word order information of the API call sequence. For each word, a fixed-length content vector and a position vector are obtained, which respectively represent the characteristics of the current word and the position information in the sequence.

[0092] Specifically, the WordPiece algorithm is first used to convert the API call sequence into a vocabulary. Then, each API call sequence is represented as ([content vector, position vector], label) and input into the BERT-Tiny model for deep feature extraction. Finally, the output of the dense layer of the model is extracted and represented as a 128-dimensional vector as the optimized feature vector to participate in subsequent classification tasks.

[0093] Compared with other existing sequence feature optimization methods, the feature optimization method based on the BERT-Tiny embedding mechanism proposed in the present invention, on the one hand, takes into account the word order relationship within the API call sequence, making the extracted feature vector more accurate and discriminative; on the other hand, using a lightweight BERT-Tiny model for feature extraction can improve operating efficiency while ensuring classification performance, which is more suitable for actual application scenarios based on multi-feature methods.

[0094] 3 Feature fusion screening based on mutual information of discrete target variables

[0095] 3.1 Calculation of Mutual Information

[0096] The feature fusion screening method based on discrete target variable mutual information (Discrete Mutual Information) proposed in the present invention selects the mutual information value of discrete target variables as the basis for evaluating features. Discrete target variable mutual information is a commonly used metric in information theory, usually used to measure the correlation between two random variables. When one of the random variables is discrete, the discrete target variable mutual information can be used to describe the degree of correlation between the two variables. Suppose there are two discrete random variables X and Y, and their joint probability distribution is The marginal probabilities are P(X) and P(Y) respectively. Then, the calculation of the discrete target variable mutual information between X and Y can be expressed as formula (2):

[0097]

[0098] in, For X i and Y j The joint probability distribution of Xi and Y j The marginal probability, X i , Y j It can be understood as a specific value of random variables X and Y, N is the number of samples, and the base of log can be any value, usually using 2 or natural logarithm e as the base. Discrete target variable mutual information can reflect the degree of correlation between X and Y, and the larger the value, the stronger the correlation between the two. If X and Y are independent, their discrete target variable mutual information is 0; if they are completely correlated, their discrete target variable mutual information is equal to the entropy of one of the random variables. In the present invention, mutual information is used to characterize the degree of dependence between features and labels, that is, the degree of correlation with labels. The larger the mutual information value, the smaller the uncertainty of the sample label after using this feature. If the mutual information is 0, it means that the label and the feature are independent of each other and there is no dependency relationship, that is, this feature does not contribute to the classification. Therefore, in feature selection, the discrete target variable mutual information value is used to evaluate the correlation between each feature and the target variable, so as to select the most distinguishing feature and filter out the features with limited contribution value or completely invalid. Such screening not only provides higher quality features, but also helps to improve the subsequent classification effect, but also realizes interpretable dimensionality reduction for the features, which also helps to improve the subsequent classification efficiency.

[0099] 3.2 Screening of fusion features

[0100] Feature selection is an important step in machine learning model development as it helps reduce the dimensionality of the dataset and remove unnecessary redundancy to improve the performance of the model. In this paper, we use the discrete target variable mutual information algorithm to calculate the mutual information value of the features, which is then used as the basis for feature fusion selection, with the goal of determining the most informative and predictive associated features, thereby improving the accuracy of the classification model.

[0101] Based on the algorithmic idea of ​​recursive feature elimination, the present invention designs a fusion feature screening algorithm, and the specific operation is as follows: select the first n features with the highest mutual information value in turn (before 300 dimensions, n increases by 10 dimensions, and after 300 dimensions, n increases by 50 each time), and use the K-fold cross validation of the machine learning model to evaluate them; then record the evaluation results, and select the best feature combination as the final selected fusion feature. The algorithm flow is as follows Fig.14 shown.

[0102] Many existing research works use different random numbers to divide the training set and test set in a certain ratio. When using different random numbers to divide the data set, it is easy for the accuracy of the model to change significantly due to the different divisions of the data set; at the same time, the model only verifies and evaluates part of the data, lacks comprehensiveness, and cannot measure the performance of the model on the entire data set.

[0103] The present invention chooses to use K-fold cross validation to make up for this deficiency. The basic principle is to create a series of training sets and test sets, calculate the accuracy of the model on each test set, and then calculate the average value as the final accuracy of the model.

[0104] The specific steps are as follows:

[0105] ① Divide the original data set into K equal parts (folds);

[0106] ②Use the first part as the test set and the rest as the training set;

[0107] ③Train the model and calculate the accuracy of the model on the test set;

[0108] ④ Each time, use a different part as the test set and repeat steps ② and ③ K times;

[0109] ⑤ Take the average accuracy as the final model accuracy.

[0110] Cross-validation, which divides the dataset into K subsets, trains the model on K-1 subsets, and uses the remaining subsets for validation, helps estimate the performance of the model on unseen data. The process is repeated K times, and each subset is used once as a validation set. By averaging the performance of K-fold validations, the performance of the model on unknown data can be more accurately estimated, which is very suitable for the realistic background where the number of malware variants is doubling. The feature fusion selection algorithm proposed in the present invention uses K-fold cross-validation to evaluate the performance of the selected features, which helps prevent overfitting and improve the generalization ability of the model. Because this method ensures that the selected features are not only informative and predictive for the training data, but also for other parts of the data.

[0111] Compared with other existing feature selection methods, the feature selection algorithm based on the mutual information value of discrete target variables proposed in the present invention has the following advantages: first, it can identify the features with the largest amount of information and the strongest predictiveness, which is very critical for improving the detection performance of classification learning models; second, it has certain flexibility in practical applications and can be flexibly adjusted and optimized according to specific needs and available computing resources and data conditions; third, it can be used to reduce the dimension of the data set, and this method is an interpretable dimensionality reduction method that maximizes the retention of effective information, which helps to achieve more efficient and higher-precision model training; fourth, it uses mutual information values ​​to identify the features with the largest amount of information, which helps to reduce the negative interference of noise and redundancy in the data set on the effective weights and improve the final classification effect; fifth, the use of sequential sorting to select the features with the largest amount of information helps to reduce the computational complexity of the algorithm; finally, the K-fold cross-validation method is used to select the final combined feature dimension, which can also prevent overfitting of model training to a certain extent, which is helpful for the robustness and generalization ability of features and models.

[0112] In short, the proposed feature fusion selection algorithm helps to extract more informative and effective features to provide more information for classification model learning, thereby helping to improve the final classification efficiency and effect. The specific effect evaluation needs to be verified through experiments.

[0113] It can be seen from the experimental results that the features processed by the feature fusion screening method proposed in the present invention are higher than any single type of features in the four indicators (classification accuracy, precision, recall rate and F1-score) in the three models of decision tree, logistic regression and random forest, including the optimized features, which shows that the proposed feature fusion method does have a positive effect on improving the classification effect. Among them, the highest classification accuracy of the random forest classifier in single feature is 99.64%, while the highest classification accuracy of the fusion feature reaches 99.94%, an increase of 0.3%, which is still very considerable and difficult for a classification model with an accuracy of more than 99%.

[0114] The experimental results of the three classifiers are also consistent with the characteristics of the model itself. Compared with decision trees and random forests, logistic regression is generally better at handling binary classification problems. For multi-classification problems, it generally needs to be transformed or the category probabilities are normalized, which has a certain transformation error. Therefore, the classification accuracy is relatively the lowest among the three. Because random forest itself is a simple integrated learning model composed of multiple decision trees, its classification results are higher than those of decision trees, which is in line with expectations.

[0115] In addition, the classification results of the three classification models also show that compared with single-type features, the random forest classification effect after adopting fusion features has the largest improvement and the highest accuracy rate. The possible reason here is that among the three models, random forest is relatively better at handling high-dimensional feature classification problems. The method proposed in the present invention finally selects 1000 as the final fusion feature dimension, which is still relatively high-dimensional. Since it is a simple ensemble learning, multiple decision tree classification results can be voted. It can be seen from the results that the proposed fusion feature has an improvement effect on the results of malware family classification, which proves the effectiveness of the fusion feature algorithm based on the mutual information of discrete target variables.

[0116] 4 Discussion on classification methods based on optimization and fusion features

[0117] In the existing research work related to intelligent classification of malware, the method of selecting a single feature type usually has the problems of limited feature type, insufficient retention of original feature representation, and a large number of shallow features, which can easily lead to interference in the classification effect of the classification model, poor generalization ability, and limited scope of application; and in the multi-feature type method, there are problems such as high feature dimension, strong feature redundancy, and insufficient accuracy of sample representation, which can easily lead to huge computational overhead of the classification model and reduced classification efficiency. Therefore, the research on the classification method of the present invention focuses on the early optimization of the intelligent classification method, focusing on the processing and optimization of sample features. In addition, in order to verify the effectiveness of the method, in the later stage of the intelligent classification method, that is, the design and optimization of the classification model, no deliberate optimization processing is performed, but three different types of models that are relatively typical and simple in structure in machine learning are selected, namely decision tree, logistic regression and random forest, to complete the classification of malware families.

[0118] These three models are relatively typical in machine learning classification models and have certain representativeness. At the same time, their structures are relatively simple and the computational overhead is relatively small. The decision tree has the advantages of being intuitive and easy to understand, highly interpretable, and able to handle nonlinear features and missing values, but it is prone to overfitting; logistic regression has the advantages of fast calculation speed, being suitable for processing large-scale data, and being able to handle binary classification problems, but its ability to handle nonlinear features is relatively poor; random forest has the advantages of being able to handle high-dimensional features, nonlinear features, and missing values, but it is relatively sensitive to outliers. These models have been widely used and studied in different fields and problems. Therefore, the selection of these three models can, in a certain sense, represent different types of models suitable for different problems, which helps to verify the universality and effectiveness of the feature processing method of the present invention.

[0119] The experimental results show that the extraction, optimization and fusion mechanisms in the method proposed in the present invention have played a positive role in the three different types of simple models selected, improving and ultimately achieving a higher classification accuracy. Therefore, it can be inferred that the effectiveness of the method proposed in the present invention is not limited to a certain type of classification model, that is, the method is not only applicable to these basic and simple classification models, but also effective in other more complex classification models. The method can obtain such ideal classification results on these basic simple classification models, which also shows that it has great potential in more complex models. Therefore, the feature optimization and fusion method proposed in the present invention only needs to select the appropriate feature dimension according to the needs, and it can adapt different types of intelligent classification models in the back end, and has strong flexibility and versatility. In the present invention, by comparison, the random forest with the best effect is selected as the classification model among the three models to achieve the family classification task of malware.

[0120] Since the feature extraction in the method of the present invention is also a deep internal correlation rather than a shallow artificial feature, it is also applicable to deep learning models. Therefore, this method provides a general and valuable sample processing method for future research and practical applications of more extensive related issues, which helps to further improve the work results in the fields of malware classification and has important theoretical and practical significance.

[0121] Overall, this study highlights the importance of feature engineering in machine learning for malware classification. The proposed method provides a practical and effective way to optimize and fuse features, which can be applied to intrusion detection, network security and other related fields. The findings of this study can provide valuable references for researchers and practitioners in network security and other related fields.

[0122] The present invention adopts a family classification method based on static analysis features for malware samples that can be directly statically reverse analyzed, and is an important part of current malware defense technology. In order to solve the problem of missing information in single features or single-type features in existing work, static multi-type features of files are extracted, and a code image deep feature extraction method based on EfficientNet-B3 and an API sequence feature extraction method based on dual-path fusion are proposed. In view of the problem of missing word order logic information in the statistical features of API sequences in existing work, a sequence feature optimization method based on the BERT-Tiny embedding mechanism is proposed. In view of the problems of excessive feature dimensions and excessive redundant information in the existing feature fusion splicing methods, a feature fusion screening method based on the mutual information of discrete target variables is proposed to fuse and screen multi-type features to obtain feature vectors with smaller dimensions and more comprehensive information. Malware family classification is achieved based on three typical machine learning classification models, namely decision trees, logistic regression and random forests. The experimental results show that:

[0123] (1) In terms of feature representation, the present invention selects three types of features, including statistical features based on static analysis, code image features, and static API sequence features. These three types of features contain multi-level and multi-type information at the instruction level, structure level, and behavior level. The feature combinations at different levels and types complement each other and more comprehensively characterize the program feature information of the original sample, which is more comprehensive than the single feature or single type feature representation commonly selected in existing work;

[0124] (2) In terms of feature extraction, the deep features extracted by the image feature extraction method based on EfficientNet-B3 proposed in the present invention are superior to the existing feature extraction methods based on traditional image texture features and other deep learning methods in terms of classification performance, both in visual analysis and quantitative analysis;

[0125] (3) In terms of classification efficiency, the fusion features obtained by the feature optimization and fusion method proposed in the present invention have a significantly reduced dimension, lower training overhead, and higher classification efficiency than the features obtained by directly splicing the extracted shallow features.

[0126] (4) In terms of classification effect, the fusion features extracted, optimized and integrated by the method proposed in the present invention have a classification accuracy rate at a relatively high level among existing related works on three different types of simple machine learning classification models. At the same time, compared with the existing mainstream features and the single optimized features proposed in the present invention, the fusion features have improved classification accuracy, precision, recall rate and F1-score.

[0127] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A malware family classification method based on static multi-feature optimization and fusion, characterized in that: include: Step 1: Extract malware image features based on the deep neural network EfficientNet-B3; The static API sequence is extracted by using the disassemblers IDA Pro and Radare2 respectively, and the extraction results of the two are merged to obtain the merged static API sequence; the static statistical features of the malware are extracted, and the static statistical features include the statistical features of the assembler file, the statistical features of the binary byte file and the file byte sequence features; Step 2: Optimize the features of the fused static API sequence based on the lightweight natural language processing model BERT-Tiny embedding mechanism; Step 3: Based on the code image features extracted in step 1, the static statistical features of the malware, and the static API sequence features optimized in step 2, the mutual information value of the features is calculated using a discrete target variable mutual information algorithm, and the optimal fusion feature sequence combination is selected based on the mutual information value of the features; Step 4: Input the optimal fusion feature sequence combination into the classification model to complete the malware family classification.

2. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The extraction of code image features based on the deep neural network EfficientNet-B3 includes: Each 8 bits of the malware binary file are combined into a vector, which is regarded as the grayscale value of a pixel in the grayscale image. A square code image with equal height and width is generated, and then all the generated square images of different sizes are normalized to obtain grayscale images of the same size. Taking the obtained grayscale image as input, the EfficientNet-B3 model is used to extract malware image features.

3. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Get the fused static API sequence as follows: IDA Pro is used to recursively traverse and read the assembly file to obtain the static API sequence of the sample. Radare2 is used to extract the control flow information and then obtain the static API sequence of the sample. Two sets of static API sequences of the same file are obtained. The static API sequence extracted based on Radare2 and the static API sequence extracted based on IDA Pro are dual-fused to obtain the fused static API sequence.

4. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Extract statistical features of assembler files as follows: Construct a list of features to be matched, including registers, opcodes, keywords, and API call names; Each feature in the feature list is counted in each program through string matching, and finally the feature vector is saved.

5. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Extract statistical features of binary byte files as follows: For the binary byte file of the disassembled program, two features, file size and byte information entropy, are extracted as statistical features of the binary byte file. The total number of bytes contained in the statistical file is taken as the file size. The file byte information entropy is calculated as follows: where p k It is the ratio of bytes with value k to all bytes.

6. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Extract file byte sequence features as follows: For the assembly program file, the .asm file generated by IDA Pro disassembly is selected, and the description of the key information of the program PE file and the description bytes of the program code segment initialization in the header part of the file are used as the file byte sequence feature vector; For a binary byte file, take the first 1000 bytes as the file byte sequence feature vector.

7. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The step 2 comprises: First, the WordPiece algorithm is used to convert the static API sequence features into a vocabulary. Then, each static API sequence is represented as ([content vector, position vector], label) and input into the BERT-Tiny model for deep feature extraction. Finally, the output of the fully connected layer of the BERT-Tiny model is extracted and used as the optimized static API sequence feature vector.

8. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The method of calculating the mutual information value of a feature using a discrete target variable mutual information algorithm includes: Where MI(X,Y) is the mutual information value of the discrete target variable between X and Y, X and Y are two discrete random variables, For X i and Y j The joint probability distribution of X i and Y j is the marginal probability of , and N is the number of samples.

9. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The method of selecting the optimal fusion feature sequence combination based on the mutual information value of the features includes: The first n features with the highest mutual information values ​​are selected in turn and evaluated using K-fold cross validation of the machine learning model; the evaluation results are then recorded and the best feature combination is selected as the final selected fusion feature.

10. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The classification models include decision trees, logistic regression, and random forests.

Images